The EU AI Act's Article 50 transparency rules went enforceable on August 2, 2026. If you ship a generative AI feature that touches EU users, you now owe the regulator a machine readable marking on your output. The obvious shortcut, drop a C2PA manifest and call it done, does not survive contact with production. Here is what actually works, with the code to make it real.
The Two Layer Reality
Article 50(2) requires effective, interoperable, robust, and reliable marking. The EU Code of Practice interprets that as at least two layers: signed metadata (C2PA) plus imperceptible watermarking (SynthID or equivalent). Fingerprinting is optional layer three.
The reason for two layers is not bureaucratic. It is a screenshot.
C2PA lives in a JUMBF metadata box. X strips it on upload. CDNs strip it during optimization. Screenshots destroy it entirely. Microsoft admitted this openly in its February 2026 Media Integrity report: preventing every attack on provenance is not possible.
